This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You. Pharmone is a product of Aelius Venture Limited.

1. Information Collection and Use

We collect several different types of information for various purposes to provide and improve our Service to you.

Types of Data Collected

Personal Data: While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you ("Personal Data"). Personally identifiable information may include, but is not limited to: Email address, First name and last name, Phone number, Address, State, Province, ZIP/Postal code, City.
Usage Data: We may also collect information how the Service is accessed and used ("Usage Data"). This Usage Data may include information such as your computer's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

2. Use of Data

Aelius Venture Limited uses the collected data for various purposes:

To provide and maintain our Service
To notify you about changes to our Service
To allow you to participate in interactive features of our Service when you choose to do so
To provide customer support
To gather analysis or valuable information so that we can improve our Service
To monitor the usage of our Service
To detect, prevent and address technical issues

3. Key Privacy Policy Clauses for PharmOne

1. Identity Verification & NHS login Integration

Identity Verification via NHS login: "To register and securely authenticate you within PharmOne, we integrate with NHS login. During onboarding, your personal details (such as full name, date of birth, NHS number, email address, and mobile number) are shared with NHS England to verify your identity. NHS England acts as the Data Controller for the identity verification process. Once verified, PharmOne receives your verified identity profile via the Personal Demographics Service (PDS) FHIR API to manage your account securely."

2. Legal Basis for Processing Special Category Health Data

Lawful Basis for Processing (UK GDPR): "We process your personal information and special category health data (including medication details, prescription history, and clinical service bookings) under the following lawful bases:

Article 6(1)(a) – Consent: Explicit user consent provided when opting into specific clinical features and notifications.
Article 6(1)(b) – Contractual Necessity: Processing required to fulfill prescription tracking and healthcare appointment bookings requested by you.
Article 9(2)(h) – Provision of Health or Social Care: Processing necessary for the management of healthcare systems, delivery of pharmacy services, and treatment per Schedule 1, Part 1 of the Data Protection Act 2018."

3. Data Processing & Information Flow Scope

How We Process Your Healthcare Information: "PharmOne collects personal and health information directly provided by you, as well as demographic records retrieved via NHS Spine APIs. This information is processed strictly to:

Authenticate your identity and verify your account via NHS login.
Allow you to schedule, view, and track clinical services (e.g., Pharmacy First, vaccinations) booked with partner pharmacies.
Log and track repeat prescription requests for fulfillment by your selected community pharmacy.

PharmOne does not sell, rent, or monetize your health data under any circumstances. Data is shared strictly with your nominated pharmacy provider or GP surgery as required to deliver your requested service."

4. Encryption, Security & Data Storage Location

Data Protection & Technical Safeguards: "Your Patient Identifiable Data (PID)—including NHS numbers, medical records, and personal contact details—is encrypted both in transit (using TLS 1.3 encryption) and at rest using bank-grade AES-256-GCM field-level encryption. All primary databases, server infrastructure, and backups are hosted exclusively on secure UK-based cloud infrastructure complying with NHS Data Security and Protection Toolkit (DSPT) standards."

5. Data Subject Rights & Data Retention

Your Data Protection Rights: "Under UK GDPR, you maintain explicit rights regarding your healthcare data:

Right of Access (SAR): Request a copy of all personal and clinical data held about you in PharmOne.
Right to Rectification: Request corrections to inaccurate personal records.
Right to Erasure / Account Deletion: Request the deletion of your account and app data (subject to legal or regulatory clinical retention requirements imposed by health authorities).
Right to Withdraw Consent: Revoke consent for non-essential communications or app features at any time via App Settings."

4. Security of Data

The security of your data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

5. Service Providers

We may employ third party companies and individuals to facilitate our Service ("Service Providers"), to provide the Service on our behalf, to perform Service-related services or to assist us in analyzing how our Service is used.

6. Contact Us

If you have any questions about this Privacy Policy, please contact us at: Aelius Venture Limited, 20 Red Lion St, London WC1R 4PS